Governance and Defense: SBOMs, Vendor Risk, and Countering Pre-Positioning
You cannot secure what you cannot enumerate, and you cannot outsource what you refuse to govern. The software bill of materials turns a black-box stack into an inventory you can question, and vendor risk management turns a handshake into a standard you can enforce. But the hardest adversary changes the whole posture: against an actor whose success is silence, waiting for an alarm is surrender. Assume the quiet foothold already exists and hunt for it. Governance is not paperwork. It is the difference between discovering your exposure on your own terms and discovering it on the adversary's.
Knowledge check
Why must defending against nation-state pre-positioning rely on proactive threat hunting rather than on incident-triggered response?
Show the answer
Because a pre-positioning operation is designed to cause no incident. It establishes quiet, durable access and waits, producing no outage, theft, or alert to trigger response. If you only act when an alarm fires, you will never find an adversary whose whole design is to avoid firing one, so defenders must assume a foothold exists and go actively looking for it.